CVE-2026-55086: Etherpad predictable temp file paths enable symlink-based file overwrite

CVE-2026-55086 · Severity: medium · CVSS 4.2 · Published 2026-08-13

Etherpad's import and export functions generate temporary file paths using JavaScript's Math.random() function, which produces only ~32 bits of entropy and is predictable. An attacker with local access to a shared system (like a multi-tenant server or Kubernetes node) can predict these paths, create a symlink to a sensitive file, and trick Etherpad into overwriting that file. This is particularly dangerous if Etherpad runs with elevated privileges (such as root in a Docker container), potentially allowing the attacker to modify system configuration files or other sensitive data.

Technologies: ep_etherpad-lite (npm). Vendors: npm.

Quick answers

Is CVE-2026-55086 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55086 being exploited in the wild.
How severe is CVE-2026-55086?
Medium severity, with a CVSS score of 4.2, published 13 August 2026.
Which products and versions are affected?
ep_etherpad-lite (npm) <= 3.0.0, SEMVER:introduced=0,fixed=3.1.0.
Is there a fix for CVE-2026-55086?
Yes. ep_etherpad-lite (npm): upgrade to 3.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55086 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-55086?
Check whether you run ep_etherpad-lite (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • ep_etherpad-lite (npm): upgrade to 3.1.0 or later
    npm install ep_etherpad-lite@3.1.0

Technical details

The vulnerability exists in src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts, which compute temporary file paths using Math.floor(Math.random() * 0xFFFFFFFF). Math.random() is cryptographically insecure and yields only ~32 bits of entropy; furthermore, V8 shares PRNG state between consecutive calls, making the sequence predictable to an attacker who observes earlier temp-file names. These paths are written to os.tmpdir() (typically /tmp on Linux), a shared world-writable directory. An unprivileged local attacker can pre-create a symlink at a predicted path pointing to any file the Etherpad process can write. When ExportHandler or ImportHandler write to the temp path, the open syscall follows the symlink and overwrites the linked target. For deployments where Etherpad runs as a privileged user (root in Docker, certain snap configurations, or custom systemd units), this becomes arbitrary file overwrite. The import path is especially impactful because the attacker can partially control the content written via the post-conversion output of an uploaded document. The fix, deployed in commit 8c6104c (v3.1.0+), replaces Math.random() with crypto.randomBytes(16).toString('hex'), providing 128 bits of CSPRNG entropy.

Affected products

  • Etherpad ep_etherpad-lite <= 3.0.0

Identifiers

  • CVE-2026-55086
  • GHSA-2jwf-f4xq-f24h

Timeline

  • 2026-08-13: disclosed: GHSA-2jwf-f4xq-f24h published on OSV and GitHub Security Advisory
  • 2026-05-17: patched: Fix deployed in commit 8c6104c (PR #7784), included in ep_etherpad-lite v3.1.0+

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.